Search code examples
authenticationsingle-sign-onopenam

SSO Authentication

I need some guidance on my SSO implementation. I have done couple of SAML2 implementations with success but there is something missing on this one :-O I believe it is minor but I am not sure what I am missing and I not seeing much information in the logs on the agent side :-/

So :

  • IDP Initiated
  • I am the SP Using OpenAm 10
  • Using J2EE Agent
  • Same configuration works on prod as well for other clients
  • SAML 2 implementation
  • The cross domain is enable
  • Certificate is loaded in the client IDP Metadata on my side

The issue is when I get the Response from the Vendor, they get redirected by the CDCSERVLET to the Login Page of OpenAm .. I am not getting why they are not authenticated.

Here the response:

<Response ID="_FAD290A87DB14BC4A8A8F435DEBDEBB3" Version="2.0" IssueInstant="2015-12-31T20:59:34.1012911Z" Destination="https://sso.com:443/sp/Consumer/metaAlias/xxx-test/sp" xmlns="urn:oasis:names:tc:SAML:2.0:protocol">
        <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">xxx</Issuer>
        <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
                    <SignedInfo>
                               <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                                <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                                <Reference URI="#_FAD290A87DB14BC4A8A8F435DEBDEBB3">
                                            <Transforms>
                                                        <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                                                        <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                                            </Transforms>
                                            <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                                            <DigestValue>HPTUTyPjegeyjDW5lmMb8ggbwas=</DigestValue>
                                </Reference>
                    </SignedInfo>
                    <SignatureValue>4Ek0xpDPj5Q==</SignatureValue>
        </Signature>
        <Status>
                    <StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
        </Status>
        <Assertion Version="2.0" ID="_BCA1E13E205E4CDCB7AB903E90606DBD" IssueInstant="2015-12-31T20:59:34.1012911Z" xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
                    <Issuer>xxx</Issuer>
                    <Subject>
                                <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified">100</NameID>
                                <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                                            <SubjectConfirmationData NotOnOrAfter="2015-12-31T21:04:34.1948917Z" Recipient="https://sso.com:443/sp/Consumer/metaAlias/xxx-test/sp"/>
                                </SubjectConfirmation>
                    </Subject>
                    <Conditions NotBefore="2015-12-31T20:54:34.1012911Z" NotOnOrAfter="2015-12-31T21:04:34.1012911Z">
                                <AudienceRestriction>
                                            <Audience>xxx-test:saml2</Audience>
                                </AudienceRestriction>
                    </Conditions>
                    <AuthnStatement AuthnInstant="2015-12-31T20:59:34.1012911Z">
                                <SubjectLocality Address="000.0.0.000"/>
                                <AuthnContext>
                                            <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef>
                                </AuthnContext>
                    </AuthnStatement>
                    <AttributeStatement>
                                <Attribute Name="AIN">
                                            <AttributeValue xsi:type="xsd:string">100</AttributeValue>
                                </Attribute>
                    </AttributeStatement>
        </Assertion>

What I noted in that assertion is :

  • There is no certificate in the Signature (All my client have the in the signature with the certificate)

On my side for the SP, I made sure that:

  • The Authentication Context is set to Password to match the assertion
  • I Disable the Federation if the NameId is Unspecified and I use the NameId as UserId

All of that should be good on my side, and I do not understand why the client gets redirected to the login page of OpenAM

Any help would be awesome !!

Thanks !

EDIT :

So, I had the vendor modified the assertion to send the <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">xxxx</NameID> And I added a user to the realm, and use it as transient user in my SP configuration but it resulted in the same issue !!

When the nameid-format was set as unspecified, I created that 100 user in the realm as a subject but it still did not work :-/

EDIT 3 : Here some information on the Session:

<SessionNotification vers="1.0" notid="117627">
<Session sid="AQIC5wM2LY4SfcxfxdL6szA_aGlQEkFtHROifZHX_VpqHag.*AAJTSQACMDIAAlNLABM3OTI1OTk2NjE0MDA1MjA2MTcw*" stype="user" cid="id=user-test,ou=user,dc=openam,dc=forgerock,dc=org" cdomain="dc=openam,dc=forgerock,dc=org" maxtime="60" maxidle="30" maxcaching="5" timeidle="1800" timeleft="1529" state="destroyed">
<Property name="CharSet" value="UTF-8"></Property>
<Property name="UserId" value="user-test"></Property>
<Property name="FullLoginURL" value="/sp/UI/Login?ForceAuthn=false&amp;MinorVersion=0&amp;RequestID=see601a9040131cc9c9d09947cf1addab3e4df292&amp;refererservlet=https%3A%2F%2Fs-----6ForceAuthn%3Dfalse%26ProviderID%3Dhttps%253A%252F%252Fstagingcng.inspirus365.com%253A443%252F%253FRealm%253D%25252F%26MinorVersion%3D0%26Federate%3Dfalse%26IssueInstant%3D2016-01-12T21%253A30%253A22Z%26MajorVersion%3D1&amp;IssueInstant=2016-01-12T21%3A30%3A22Z&amp;MajorVersion=1"></Property>
<Property name="successURL" value="/sp/console"></Property>
<Property name="cookieSupport" value="true"></Property>
<Property name="AuthLevel" value="0"></Property>
<Property name="SessionHandle" value="shandle:AQIC5wM2LY4SfcwZfnMFJVMF0olMGhmq-Nmqw_BMxoVv4AA.*AAJTSQACMDIAAlNLABM3OTI1OTk2NjE0MDA1MjA2MTcw*"></Property>
<Property name="UserToken" value="user-test"></Property>
<Property name="loginURL" value="/sp/UI/Login"></Property>
<Property name="Principals" value="user-test"></Property>
<Property name="Service" value="ldapService"></Property>
<Property name="sun.am.UniversalIdentifier" value="id=user-test,ou=user,dc=openam,dc=forgerock,dc=org"></Property>
<Property name="amlbcookie" value="01"></Property>
<Property name="Organization" value="dc=openam,dc=forgerock,dc=org"></Property>
<Property name="Locale" value="en_US"></Property>
<Property name="HostName" value="205."></Property>
<Property name="AuthType" value="DataStore"></Property>
<Property name="Host" value="205."></Property>
<Property name="UserProfile" value="Ignore"></Property>
<Property name="clientType" value="genericHTML"></Property>
<Property name="AMCtxId" value="a0749ff708bff14202"></Property>
<Property name="SessionTimedOut" value="1452636294"></Property>
<Property name="authInstant" value="2016-01-12T21:30:33Z"></Property>
<Property name="Principal" value="id=user-test,ou=user,dc=openam,dc=forgerock,dc=org"></Property>
</Session>

The thing that struck me is the <Property name="AuthType" value="DataStore"></Property> (I have Federation from other vendors :0) I am sure that the issue is because the user cannot get authenticated against OpenAM.

Solution

  • I figured it out ... Turned out everything was set up right but our partner was posting the Assertion to the Relay/Target URL and not the Consumer URL .....